@coreiam/auth 1.0.1 → 1.0.2

package/dist/nextjs/actions.d.ts

@@ -4,10 +4,6 @@ export interface AuthResult {
     status: number;
     data: any;
 }
-/**
- * NEW: Securely gets the user session.
- * Handles 401 by attempting a silent refresh internally.
- */
 export declare function getSession(): Promise<CoreIAMIdentity | null>;
 export declare function loginActionSdk(identifier: string, password: string): Promise<AuthResult>;
 export declare function registerActionSdk(userData: any): Promise<AuthResult>;

package/dist/nextjs/actions.js

@@ -9,6 +9,8 @@ exports.logoutActionSdk = logoutActionSdk;
 const headers_1 = require("next/headers");
 const core_1 = require("../core");
 const iam = new core_1.CoreIAM();
+// GLOBAL LOCK: Prevents concurrent refresh requests
+let refreshLock = null;
 async function syncCookiesToNext(response) {
     const cookieStore = await (0, headers_1.cookies)();
     const setCookies = response.headers.getSetCookie();
@@ -58,30 +60,38 @@ async function syncCookiesToNext(response) {
         }
     }
 }
-/**
- * NEW: Securely gets the user session.
- * Handles 401 by attempting a silent refresh internally.
- */
 async function getSession() {
     const reqHeaders = await (0, headers_1.headers)();
     let response = await iam.proxy('/auth/profile', { method: 'GET' }, reqHeaders);
     if (response.status === 401) {
-        const refreshRes = await iam.proxy('/auth/refresh-token', { method: 'POST' }, reqHeaders);
-        if (refreshRes.ok) {
-            const setCookies = refreshRes.headers.getSetCookie();
-            if (setCookies && setCookies.length > 0) {
-                const fakeRes = new Response(null, { headers: { 'set-cookie': setCookies.join(', ') } });
-                await syncCookiesToNext(fakeRes);
-                const cookieStore = await (0, headers_1.cookies)();
-                const newJwt = cookieStore.get('jwt')?.value;
-                const newRefresh = cookieStore.get('refreshToken')?.value;
-                const retryHeaders = new Headers(reqHeaders);
-                if (newJwt && newRefresh) {
-                    retryHeaders.set('cookie', `jwt=${newJwt}; refreshToken=${newRefresh}`);
-                    retryHeaders.set('Authorization', `Bearer ${newJwt}`);
-                }
-                response = await iam.proxy('/auth/profile', { method: 'GET' }, retryHeaders);
+        // 1. Use the lock! If another component is already refreshing, wait for it.
+        if (!refreshLock) {
+            refreshLock = iam.proxy('/auth/refresh-token', { method: 'POST' }, reqHeaders)
+                .then(res => res.ok ? res.headers.getSetCookie() : null)
+                .finally(() => { refreshLock = null; }); // Clear lock when done
+        }
+        const setCookies = await refreshLock;
+        if (setCookies && setCookies.length > 0) {
+            // 2. Sync the new cookies to the browser
+            const fakeRes = new Response(null, { headers: { 'set-cookie': setCookies.join(', ') } });
+            await syncCookiesToNext(fakeRes);
+            // 3. Build new headers with the refreshed cookies and retry
+            const cookieStore = await (0, headers_1.cookies)();
+            const newJwt = cookieStore.get('jwt')?.value;
+            const newRefresh = cookieStore.get('refreshToken')?.value;
+            const retryHeaders = new Headers(reqHeaders);
+            if (newJwt && newRefresh) {
+                retryHeaders.set('cookie', `jwt=${newJwt}; refreshToken=${newRefresh}`);
+                retryHeaders.set('Authorization', `Bearer ${newJwt}`);
             }
+            response = await iam.proxy('/auth/profile', { method: 'GET' }, retryHeaders);
+        }
+        else {
+            // 4. CRITICAL: If refresh failed, CLEAR THE COOKIES to break the infinite loop!
+            const cookieStore = await (0, headers_1.cookies)();
+            cookieStore.delete('jwt');
+            cookieStore.delete('refreshToken');
+            return null;
         }
     }
     if (!response.ok)
@@ -89,7 +99,6 @@ async function getSession() {
     const coreIamIdentity = await response.json();
     if (!coreIamIdentity?.sub)
         return null;
-    // Return the Provider's Identity, NOT the Customer's User
     return coreIamIdentity;
 }
 async function loginActionSdk(identifier, password) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coreiam/auth",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "main": "./dist/core/index.js",
   "types": "./dist/core/index.d.ts",
   "exports": {